home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
Shareware 1 2 the Maxx
/
sw_1.zip
/
sw_1
/
VIRUS
/
HTSCAN17.ZIP
/
WHATSNEW.DOC
< prev
Wrap
Text File
|
1992-04-16
|
7KB
|
147 lines
Version 1.17 (April 1992)
- Starting with version 1.17 HTScan will be available in several languages.
- With /$? it is possible to get help for the advanced options.
- A new option /$M has been introduced. With this option you can specify a
directory to which infected files should be moved.
- An other new option /$U has been introduced for running unattended. When used,
HTScan will not ask whether a file should be moved, renamed or deleted.
- The boot-record markers are no longer checked. This will eliminate the high
number of warnings about an unusual boot-sector.
- HTScan now supports AVR's (Algorithmic Virus Recognition) modules.
- HTScan will use the new ADDNSIGS.DAT file.
- HTScan now check's the checksum in VIRSCAN.DAT
- HTScan now supports external compressed file signatures in the file
COMPRSCA.DAT
- HTScan will abort with errorlevel 75..99 if a run-time error occurred.
- It is now possible to generate a more accurate message with the first
character of the signature.
Version 1.16 (October 1991)
- THE DEFAULT ERRORLEVEL SETTING AT THE END OF THE PROGRAM HAS BEEN CHANGED.
In earlier version of HTScan the default was /$W- now the default is /$W+.
This default change was announced in de doc's of version 1.14 and 1.15.
- Placing every option in HTScan.CFG in a separate line is now possible.
An example of HTScan.CFG can be found in Examples.zip
- It is now possible to place your own messages in the file HTScan.MSG.
These messages will be displayed, depending on the errorlevel of HTScan,
after HTScan ended.
An example of HTScan.MSG can be found in Examples.zip
- HTScan now also looks for a file MCAFEE.DAT and HTTROJAN.DAT in the same
directory as VIRSCAN.DAT and/or HTSCAN.DAT and/or VIRUSBUL.DAT.
MCAFEE.DAT may contain search strings in McAfee format. HTTROJAN.DAT may
contain search strings for trojans and jokes in a HTSCAN.DAT style.
HTTrojan.Dat is included in this package. An example of McAfee.Dat can be
found in Examples.zip
- When multiple signature-files are used, every signature has a postfix
indicating the origin signature-file.
- With "&<drive>", you can specify to scan all drives starting with the
specified one. With "&<drive>..<drive>" you can specify a range of drives
to scan.
- A new option "/W-" and "/W+" has been introduced. With this option you can
toggle the warnings for compressed/self-extracting files.
- Option "/M" and "/U" are now enhanced with the "-".
"/M-" means don't scan memory and "/U-" means don't scan upper-memory-blocks.
- Option "/Q" is now enhanced with the "+".
With this option you specify to display only the directory names while
scanning instead of every file.
- A new advanced option, /$G, is introduced which means search for every boot-
record virus in COM and EXE files. /$G and /A combined means scan every file
for all file-viruses and all boot-record viruses.
- Another new advanced option, /$A, is introduced which means display all
scanned files in the log-file. Whether infected or not.
- The last new option is "/$USlow". With this option you specify to slow down
the upper memory scan to avoid hardware errors when scanning the
upper-memory.
- The maximum size of the hex-scanstring in HTScan.Dat has been raised to 100
Version 1.15 (June 1991)
- wildcards in the first 2 bytes of the signature are now allowed.
- %x after %x in HTScan.Dat is now allowed.
- x? or ?x after ** or %x in HTScan.Dat is allowed if the following byte in
the signature file does not contain a wildcard.
- EXAMPLES.DAT with signatures for the TEQUILA virus has been included in the
package.
- The documentation has been improved.
- HTScan displays the warnings now in a message window on the screen
- The implementation of ** has been optimized resulting in a better
speed when family-signatures are used.
- The maximum length of the garbage to skip with ** has been raised to 255.
Version 1.14 (April 1991)
- A bug in relation with HTScan.CFG has been fixed.
- % in the scan-string is now supported.
%x means, ignore up to x bytes.
- The maximum length of the garbage to skip with ** has been raised to 200.
This allows to scan for family-signatures instead of single-virus
signatures.
- A new item name is introduced. UMB which means scan the
Upper-Memory-Blocks. (The memory between 640 Kb and 1 Mb)
The High-Memory-Area is treated as UMB but only scanned when active.
(The High-Memory-Area, when available, is the 64 Kb just above 1 Mb)
- A new option, /U+, is introduced which means scan the Upper-Memory-Block's
for all resident viruses.
With QEMM or Dos 5.0, /U+ is the default.
- With {, } and XX it is now possible to scan for XORred parts in a virus.
- HTScan will warn in the log-file when a self-extracting or compressed-
executable files was found.
On the screen you will see the message:
"x Compressed executable file(s) found."
- The errorlevel setting at the end of the program has been changed.
Default, or with /$W- , when an infection is found the errorlevel will
still be 1.
With /$W+ , default in future releases, errorlevel < 50 means: a warning was
triggered.
- A new option, /$O, has been added for researchers. When used, the offset
where the scan-string was found will be written in the log-file.
- Two new options, /$T and /$B, are introduced to preserve space on the screen
for a shell program.
- HTScan is no able to handle a third signature-file with a special syntax for
Virus-Bulletin readers.
Version 1.13 (february 1991)
- Spaces within the hex signature string are allowed now.
- Screens with more, or less, then 25 lines are supported too.
- HTScan now beeps when a virus is found.
- A file containing the filenames to scan are allowed too.
(See '@' in the documentation.)
- A special switch for network users has been added. See /$NOE.
- It is now possible to scan a disk with wildcards.
E.g scan all *.COM files on drive C: with "HTSCAN C:\*.COM"
Version 1.12 (november 1990)
- Compared to version 1.11, version 1.12 is about 5% faster.
- A minor bug, in relation with /A, has been fixed.
Version 1.11 (november 1990)
- Compared to version 1.10, version 1.11 is about 45% faster.
Version 1.10 (october 1990)
- It is now possible to scan conventional memory.
With LOW en HIGH in the second line of a virus-signature you can specify
which part of the memory has to be search with this signature.
With /M you can force HTScan to scan LOW and HIGH memory for all viruses.
- Now, only the first 2 bytes of the virus-signature (4 hex chars) may
not contain wild-cards. In version 1.00 this was 4 bytes.
- The wildcard * has been changed to stay compatible with VirScan.Dat.
- The user-interface has been improved
Version 1.00 (june 1990)
Initial release